Security update for nodejs16
This update for nodejs16 fixes the following issues: Update to LTS version 16.20.2. - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150). - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156). - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for nodejs16 fixes the following issues: Update to LTS version 16.20.2. - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150). - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156). - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1214150
- https://bugzilla.suse.com/1214154
- https://bugzilla.suse.com/1214156
- https://www.suse.com/security/cve/CVE-2023-32002
- https://www.suse.com/security/cve/CVE-2023-32006
- https://www.suse.com/security/cve/CVE-2023-32559
- https://www.suse.com/support/update/announcement/2023/suse-su-20233379-1/